2026 CVEs (page 90)
Page 90 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-21586 | | 2026-09-15 | This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0… | |
CVE-2026-19780 | High | 8.8 | 2026-09-15 | Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of… |
CVE-2026-18111 | | 2026-09-15 | Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting (XSS) in the Feature, Feature Link, Hero Image, and Image blocks and before Concrete… | |
CVE-2026-18110 | High | 7.5 | 2026-09-15 | Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete endpoint (/ccm/system/user/autocomplete), which… |
CVE-2026-91992 | Medium | 5.9 | 2026-09-15 | Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clear… |
CVE-2026-91991 | Medium | 5.4 | 2026-09-15 | Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitaliz… |
CVE-2026-91990 | High | 7.5 | 2026-09-15 | Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limi… |
CVE-2026-91989 | High | 7.5 | 2026-09-15 | atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by s… |
CVE-2026-91988 | High | 8.1 | 2026-09-15 | atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the-middle attackers t… |
CVE-2026-91987 | Medium | 6.5 | 2026-09-15 | atomic-agents-stack before 1.1.0 contains a cost-guardrail bypass in the _estimate_batch_cost function that returns zero cost for unknown models not in the pri… |
CVE-2026-91986 | Medium | 5.4 | 2026-09-15 | gitoxide gix-transport before 0.59.2 fails to filter control characters in git-daemon connect requests, allowing attackers to inject NUL/CR/LF bytes via crafte… |
CVE-2026-91985 | High | 7.5 | 2026-09-15 | Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only members to obtain the sh… |
CVE-2026-91984 | Medium | 4.3 | 2026-09-15 | Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task's project. Authenticated attackers can… |
CVE-2026-91983 | Medium | 4.3 | 2026-09-15 | Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query string parameters. Atta… |
CVE-2026-91982 | Medium | 4.3 | 2026-09-15 | Vikunja before 2.6.0 continues to expose the raw TOTP shared secret after enrollment through the GET /api/v1/user/settings/totp and /api/v1/user/settings/totp/… |
CVE-2026-91981 | Medium | 4.3 | 2026-09-15 | Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumer… |
CVE-2026-91980 | Medium | 4.3 | 2026-09-15 | vikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to enumerate all teams and members. Attackers… |
CVE-2026-91979 | Medium | 6.5 | 2026-09-15 | Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service. Attackers can upload highly… |
CVE-2026-91973 | High | 7.5 | 2026-09-15 | Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remote unauthenticated a… |
CVE-2026-91972 | High | 7.5 | 2026-09-15 | Vikunja versions before 2.6.0 fail to apply rate limiting to /api/v2 public authentication endpoints including login, register, password-reset, and OAuth token… |
CVE-2026-91971 | Medium | 6.5 | 2026-09-15 | Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to upload crafted image… |
CVE-2026-91970 | Medium | 6.5 | 2026-09-15 | Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budgets during migratio… |
CVE-2026-91969 | Medium | 6.5 | 2026-09-15 | vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to limit parsed row car… |
CVE-2026-91968 | Medium | 6.5 | 2026-09-15 | vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expressions without rec… |
CVE-2026-91967 | Medium | 5.0 | 2026-09-15 | AVideo through 29.0 contains a blind server-side request forgery vulnerability in the getHeaderContentTypeFromURL function that issues get_headers() calls guar… |
CVE-2026-91966 | Medium | 5.8 | 2026-09-15 | AVideo through 29.0 contains an unauthenticated server-side request forgery vulnerability in the check_site_availability function that accepts attacker-control… |
CVE-2026-91965 | High | 7.5 | 2026-09-15 | WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. Unauthenticate… |
CVE-2026-91964 | High | 8.8 | 2026-09-15 | FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attac… |
CVE-2026-91963 | Medium | 6.5 | 2026-09-15 | FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can… |
CVE-2026-91962 | Medium | 6.3 | 2026-09-15 | FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends when processing FramesPerPacket values from MSG_SNDIN_OPEN messages. Attackers c… |
CVE-2026-91961 | Medium | 6.5 | 2026-09-15 | FreeRDP before 3.31.0 contains a denial-of-service vulnerability in the URBDRC control-transfer request path that fails to validate OutputBufferSize before for… |
CVE-2026-91960 | Medium | 6.5 | 2026-09-15 | FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's Stream_EnsureRemainingCapacity function that allows remote attackers to cause denial of s… |
CVE-2026-91959 | Medium | 6.5 | 2026-09-15 | FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the RPC gateway transport parser. Attackers can send a m… |
CVE-2026-91958 | Medium | 6.6 | 2026-09-15 | FreeRDP versions before 3.31.0 fail to validate MonitorIds array values when parsing RDP connection files, allowing unbounded array indexing in xf_detect_monit… |
CVE-2026-91957 | Low | 3.1 | 2026-09-15 | FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration… |
CVE-2026-91956 | Medium | 6.5 | 2026-09-15 | FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's func_get_ep_desc function that indexes interface arrays by position… |
CVE-2026-91955 | High | 7.5 | 2026-09-15 | FreeRDP before 3.31.0 fails to validate client-supplied DesktopWidth and DesktopHeight values during GCC negotiation, allowing remote attackers to crash the se… |
CVE-2026-91954 | Medium | 6.5 | 2026-09-15 | FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdi_surface_bits when processing Surface Bits commands with NSCodec codec ID. A mali… |
CVE-2026-91953 | Medium | 6.5 | 2026-09-15 | FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO… |
CVE-2026-91952 | Medium | 6.5 | 2026-09-15 | FreeRDP versions before 3.31.0 contain an infinite-loop denial of service in the pool_decode_rect function when decoding AVC444 metablocks with more region rec… |
CVE-2026-91951 | Medium | 6.5 | 2026-09-15 | FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in the urbdrc client channel's urb_send_current_frame_number_result() function. A m… |
CVE-2026-91950 | Medium | 6.5 | 2026-09-15 | FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit unsigned integer wraparound in buffer bounds… |
CVE-2026-91949 | Critical | 9.3 | 2026-09-15 | FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections… |
CVE-2026-91948 | High | 7.5 | 2026-09-15 | FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNEL_OPTION_SHOW_PROTOCOL is… |
CVE-2026-91947 | High | 7.5 | 2026-09-15 | FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that dereferences a channel pointer after releasing the sync… |
CVE-2026-91946 | Medium | 6.5 | 2026-09-15 | FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's ResetGraphics PDU serializer that fails to initialize pad… |
CVE-2026-91945 | Medium | 6.5 | 2026-09-15 | FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in smartcard response decoders that fail to validate ATR length fields against fixed… |
CVE-2026-91944 | Medium | 6.1 | 2026-09-15 | crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement() function assigns t… |
CVE-2026-91943 | High | 7.7 | 2026-09-15 | Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where _get_pdf_path() re-downloads targets with Python… |
CVE-2026-91942 | Medium | 5.4 | 2026-09-15 | crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.inner… |
CVE-2026-91941 | High | 7.5 | 2026-09-15 | Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted clients to cause denial o… |
CVE-2026-91940 | High | 7.5 | 2026-09-15 | crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the _filter_untrusted_fields function fails to validat… |
CVE-2026-91938 | High | 7.1 | 2026-09-15 | Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF… |
CVE-2026-91937 | High | 7.5 | 2026-09-15 | Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory node. Unauthenticated… |
CVE-2026-91936 | Medium | 6.8 | 2026-09-15 | Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow_dispatch inputs are directly interpolated… |
CVE-2026-91935 | High | 8.3 | 2026-09-15 | Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrary hosts. Attackers… |
CVE-2026-91934 | High | 8.8 | 2026-09-15 | Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers… |
CVE-2026-91933 | High | 7.1 | 2026-09-15 | Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints, allowing authenticated users to access tools from Chat… |
CVE-2026-91932 | High | 8.5 | 2026-09-15 | Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an u… |
CVE-2026-91931 | High | 8.5 | 2026-09-15 | Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by sup… |
CVE-2026-91930 | High | 7.5 | 2026-09-15 | Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated users to supply arbitr… |
CVE-2026-91929 | High | 7.1 | 2026-09-15 | Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. Attacke… |
CVE-2026-91849 | Medium | 6.3 | 2026-09-15 | A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /index.php?m=member&f=user&v=setAvatar of… |
CVE-2026-91848 | High | 7.3 | 2026-09-15 | A vulnerability was identified in WuzhiCMS up to 4.1.0. Affected by this issue is the function article::getDataOfJson of the file /index.php?m=content&f=articl… |
CVE-2026-89307 | | 2026-09-15 | The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, e… | |
CVE-2026-88621 | Low | 2.7 | 2026-09-15 | OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticated administrator can… |
CVE-2026-88620 | Medium | 4.3 | 2026-09-15 | SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enf… |
CVE-2026-88619 | High | 8.1 | 2026-09-15 | 1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes schedule… |
CVE-2026-87793 | | 2026-09-15 | The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated… | |
CVE-2026-87792 | | 2026-09-15 | The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator function… | |
CVE-2026-87791 | | 2026-09-15 | A path traversal vulnerability exists in the reserved_file_check function of the functions.php file in the WordPress Design Scuole Italia theme. The vulnerabil… | |
CVE-2026-85013 | High | 7.3 | 2026-09-15 | A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the… |
CVE-2026-77972 | | 2026-09-15 | Time-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach internal network destinat… | |
CVE-2026-77866 | | 2026-09-15 | Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network destinations the lib… | |
CVE-2026-65831 | High | 7.7 | 2026-09-15 | ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database} with language: js because PolyglotQueryEngine.co… |
CVE-2026-59973 | High | 8.5 | 2026-09-15 | FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters… |
CVE-2026-59965 | High | 7.1 | 2026-09-15 | Payload Plugins is a collection of plugins designed to enhance Payload CMS. In 0.7.0, @jhb.software/payload-alt-text-plugin exposes POST /api/alt-text-plugin/g… |
CVE-2026-59157 | Medium | 6.5 | 2026-09-15 | webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without… |
CVE-2026-58196 | Medium | 4.7 | 2026-09-15 | ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.31.0, remote.Handler.Authenticate… |
CVE-2026-55887 | | 2026-09-15 | MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlle… | |
CVE-2026-55864 | | 2026-09-15 | GeoNetwork is a catalog application to manage spatially referenced resources. Prior to 4.2.17 and 4.4.12, POST /api/tools/ogc/sld accepted a caller-supplied WM… | |
CVE-2026-55828 | | 2026-09-15 | qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does n… | |
CVE-2026-55776 | Medium | 6.5 | 2026-09-15 | OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an authenticated OpenBao caller with write access to transit/keys/* could t… |
CVE-2026-55775 | | 2026-09-15 | OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-roo… | |
CVE-2026-55774 | | 2026-09-15 | OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, an OpenBao user with access to sys/leases/revoke/:lease_id in one namespace… | |
CVE-2026-55770 | Medium | 6.8 | 2026-09-15 | OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao used EscapeLDAPValue, an RFC 4514 distinguished-name escaping funct… |
CVE-2026-55701 | | 2026-09-15 | The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver… | |
CVE-2026-55636 | Medium | 5.7 | 2026-09-15 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.6, charts/capsule/templates/configuration.yaml configures the vali… |
CVE-2026-55630 | Unrated | | 2026-09-15 | Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extra_link and TestPlan.extra_link accepted unsanitized user input and rendered sto… |
CVE-2026-55591 | Medium | 5.8 | 2026-09-15 | Signal K Server is a server application that runs on a central hub in a boat. Prior to 2.28.0, makeRemoteRequest() in src/serverroutes.ts accepted attacker-con… |
CVE-2026-55211 | Critical | 9.8 | 2026-09-15 | Surfio is a library for reading and writing surface files. Prior to 0.0.19, surfio does not correctly validate size fields in IRAP files, leading to a buffer o… |
CVE-2026-54724 | Medium | 6.1 | 2026-09-15 | Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauth… |
CVE-2026-54450 | | 2026-09-15 | ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.29.1, networking.IsPrivateIP in pk… | |
CVE-2026-54077 | High | 7.1 | 2026-09-15 | ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.ja… |
CVE-2026-54076 | High | 8.1 | 2026-09-15 | ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty… |
CVE-2026-50024 | Medium | 5.3 | 2026-09-15 | GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, add_head_file_tasks parses an attacker-controlled ref p… |
CVE-2026-47215 | Medium | 4.8 | 2026-09-15 | SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string m… |
CVE-2026-44282 | Medium | 4.8 | 2026-09-15 | Decidim is a participatory democracy framework. Prior to 0.32.0, a low-privilege process-scoped administrator or election editor with question-management right… |
CVE-2026-44163 | Medium | 5.3 | 2026-09-15 | fluent-plugin-opentelemetry is a Fluentd input and output plugin for forwarding OpenTelemetry Protocol data. Prior to 0.5.3, the in_opentelemetry HTTP input re… |
CVE-2026-37152 | Critical | 9.8 | 2026-09-15 | TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access. |